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Abstract 

The paper concerns the protection of the secrecy of ballots, so that the identity of the voters 
cannot be matched with their vote. To achieve this we use an entangled quantum state to represent 
the ballots. Each ballot includes the identity of the voter, explicitly marked on the "envelope" 
containing it. Measuring the content of the envelope yields a random number which reveals no 
information about the vote. However, the outcome of the elections can be unambiguously decided 
after adding the random numbers from all envelopes. We consider a few versions of the protocol 
and their complexity of implementation. 
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I. INTRODUCTION 



Assume n parties participate in a vote to decide between a few alternatives. Each par- 
ticipant chooses his or her preference, designates it on the ballot, and puts in in the box. 
There are various ways in which the secrecy of the vote can be compromised, and we shall be 
particularly interested in the case of marked ballots. In this conspiracy the ballot is made to 
include the voter's identity, by secretly marking it prior to the vote or during it. To choose 
a rather paranoid scenario: Big Brother finds traces of the voter's DNA on the paper ballot. 
Or, in the case of an electronic ballot, a string containing the voter's identity, which has just 
been varified prior to voting, is stored together with the vote. 

In this paper we use entangled qbits to prevent such schemes. Each ballot may very well 
include the identity of the voter, explicitly marked on the "envelope" containing it. However, 
this is inconsequential because reading the contents of the envelope rveals a random number, 
and no information about the vote. On the other hand, the outcome of the elections can be 
unambiguously decided after adding the random numbers from all envelopes. 

A few quantum voting protocols have been proposed recently: Singh and Srikanth 
suggested to use a quantum version of sealed envelopes; any attempt to read their content 
by unauthorised persons can be detected. Vaccaro et.al. |2| proposed a voting scheme in 
which the number of votes is coded into the phases of an entangled state and reading the 
result involves a complicated measurement. A protocol more similar to the present one has 
been proposed by Hillery et.al. In their protocol the election result is also encoded into 
the phases of a quantum state, and its reading involves a complicated measurement. Our 
mechanism is different from |3j in various respects which will be noted below. In particular, 
the voting result is coded and read directly from the computation basis states. The protocol 
can be implemented as soon as the implementation of the discrete Fourier transform becomes 
possible. 

We begin with a protocol for a vote to decide between two alternatives. Although the 
protocol is valid for any number of voters n > 2, its implementation may be complicated 
when thousands of citizens participate in the elections. To ammend this situation we also 
propose an alternative version, whose complexity depends on the number of ballot boxes. 
The security of the protocol remains intact provided this number is > 2. Subsequently, the 
scheme is generalized to include a choice between more than two alternatives. Finally, the 
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complexity of implementation is calculated. 



II. THE PROTOCOL 



Let m be a natural number. Consider an m dimensional space with basis vectors: 
|0) , |1) , |m — 1). The m-th order discrete Fourier transform is defined to be 

T m \j) = -L V exp(^) |0 , j = 0, 1, m-l (1) 

v 1=0 

Subsequently we shall suppress the subscript m, and denote the Fourier transform by T . 
Let II be the unitary operator which defines the following cyclic permutation on the basis 
elements: 



n|o> = |i>, n [i> = |2> , ... ,n|m-i) = |o) (2) 

or, in short II \ j) = \ j © 1) where © represents addition modm. 
Suppose that we distribute among n voters the entangled state 
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l^> = 7^£U>li>---li> (3) 

V 3=0 

where each \j) is an m-dimensional basis state, and each product in the sum Q contains 
n copies. The relation between n and m will be fixed later. Each voter has to vote either 
NO, in which case he applies T to his bit; or YES, in which case she applies IFF (that is, T 
followed by II) 1 . Suppose the votes were a±, a?, a n , with = in case of a NO vote by 
person k, and = 1 in case of a YES vote. Put U° = I (identity) and II 1 = II, then after 
the vote the state is: 



\v) = (n ai ^) © (n a2 ^) © ... © (IP-.F) \w) = (4) 

. 777—1 

— y (n ai ^) li) © (u a ^) \j) © ... © (u a -T) \j) = 



3=0 

Li! ( n--^E«p(— ) l«) » ( ir-^E«p(— > !'»> 



3=0 \ v h=0 / \ v l n =0 



1 Hillery et. al. [3j use the same initial state \W), apply T for the YES vote and / (identity) in the NO 
vote. The election outcome is then recorded in the phases of a complicated state. 
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Performing the tensor product we get: 



\V) 



1 



— n exp 

3=0 h,...,l n 




(h + ... + l n ) \h © on) © ... © |f n © a n ) (5) 




exchanging the order of summation 




Unless l\ + ... + l n = O(modm) we have Y^j=o ex P + ••• + O) — 0. Hence the result 

of the vote is 



\V) 



1 



E 



k © a ± ) © ... © \l n © a n ) 



(7) 



n-l 

m 2 



ii+...+i n =0(mod m) 



Now, we measure the basis vectors and add the results modm. Since l 1 + ... + l n = 0(modm) 
for every component in the superposition in Eq.(7), we are left with the outcome a± + 
... + a n (modm). 

III. APPLICATIONS 

1. In the simplest case we choose m > n, preferably we let m be the smallest power 
of two greater than n, so we can use qbits. Then, after adding the measurement results 
modm, we simply get a± + ... + a n , which is the number of YES votes. The secrecy of the 
vote is maintained because every individual "ballot" \l r © a r ) contains the actual vote a r 
added modm to a random number l r between and m — 1. Note that the ballots are not 
mixed, and it may be public knowledge that the ballot \l r © a r ) comes from voter r (we 
may even attach an extra probe carrying his or her name). However, this information is 
inconsequential, it only reveals the fact that person r participated in the poll. 

Actually, we do not have to know in advance how many people will vote, just choose n to 
be sufficiently large. Since at the end of election day we know the exact number of people 
who participated, we push the NO button as many times as required to reach n. After the 
measurement we subtract the number of fictional votes and announce the election results. 

There is a classical protocol which is similar to the quantum ballot, but is nevertheless less 
secure: A sequence of n random numbers (h, l n ) is generated and their sum y = l 1 + ... + l n 
stored. When citizen r is voting a r , the electronic voting machine stores only the number 
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l r + a r . This way the privacy of the vote is protected. At the end of the day the stored 
numbers are added, and then y subtracted. This protocol is secured only to the extent that 
the values of the random numbers are protected. In the classical world there is always an 
interval of time when the values of the Z r 's themselves are present in the system. In the 
quantum protocol, by contrast, the numbers l r are generated only upon measurement, and 
are present only in the compounds l r © a r . 

Note that an identical result obtains if we change the protocol slightly: Firstly, we dis- 
tribute among the voters the state 

\U) = ®F)\W) = — ^ (8) 

^ li + ...+I„E0(modm) 

and secondly, each voter applies II for a YES vote, or I for NO. The choice between the two 
versions will depend on the technical detail of implementation. 

It goes without saying that even a quantum protocol cannot be secured against all possible 
attacks by Big Brother, such as complete rewiring of the voting machine, or the installation 
of video cameras in the voting booths. 

2. The single element that makes the protocol difficult to execute is the number of voters 
n. The difficulty is expressed in the structure of the initial state \W) in Eq.(3), where each 
component is a tensor product of n states. If we consider a vote of a small committee then 
producing \W) seems feasible; but what if millions of people vote? Luckily we can simplify 
the protocol to include this case. To do this let N stand for the number of ballot boxes, and 
assume that in the state \W) each component has N copies, one for each box. However, we 
keep m larger than the total number of voters n. Now, early in the morning on election day, 
an official performs T once for each box, and this is the last time the Fourier transform is 
applied to the box. Subsequently, any NO voter applies / (identity) to the part of the state 
corresponding to his box, and any YES voter applies II. By repeating the same calculation 
we get the post election state 

|V) = — jv-ir ^2 \li + a' 1 + ... + a' kl (modm))®...<g)\l N + a" + ... + al N (modm)) 

^ 2 ?i + ---+^jv=0(mod m) 

(9) 

Where a[, a' kl , are the votes cast in box 1, and so on, to a",..., a'1 , the votes in box N. 
Again, since l x + ... + l N = O(modm), then measuring the basis states and adding the results 
modm yields the sum of all YES votes from all boxes (recall that we kept m larger than n). 

5 



So why not take N = 1, that is, only one box for all voters? In this case \W) = 
^'o 1 and l W ) = 1°)' and thus 1*0 = n ai n a2 ...n a ™ |0) = |oi + ... + a n ) is the sum 
of all YES votes. In other words, using the protocol with a single ballot box brings us back 
to a classical voting system represented by an unentangled quantum state. But already with 
N = 2 there is a random element in the protocol, hiding the number of YES votes that each 
box contributes. 

3. Suppose that there are more than two alternatives, not just YES and NO, but three 
candidates to choose from, call them I, II, and III. For n voters we choose m to be bigger 
than 2n and use two copies of \W), call them \W) 1 and \W) 2 . Now, each voter applies the 
following rule: For candidate I apply T to \W) 1 and T to \W) 2 , For candidate II apply 
IU r \W) 1 and ILF|W) 2 , and for III apply U 2 J 7 \W) 1 and ILF[W> 2 . Let n u n n and n ul 
be the numbers of votes cast for the respective candidates. Applying a measurement to 
\V) 1 , the post elections state of \W) 1 , we obtain the outcome nn + 2nni- Measuring \V) 2 
yields njj + Jim. Since we know n = nj + nn + njn, we can infer the election results. 
Generalizations to a larger number of alternatives is straightforward. 



IV. COMPLEXITY OF IMPLEMENTATION. 



The implementation of the protocol requires three steps: 

1. The creation of the state \W). Consider first the basis states copier defined on 
C m <8> ... <8> C m (n copies) and whose effect is, in particular 

\j) ® |0) ® ... ® |0) -> \j) ® |j) ® ... ® |j) < j < m (10) 

To implement this suppose m = 2 k , then the operation \j) ® |0) — > \j) ® |j) can be achieved 



using bit by bit copying, each bit by the implementation of two CNOT gates 4], altogether 
2k gates. Generalizing to n copies we need O(kn) gates, k = log 2 m. To create \W), 
therefore, we apply this copying mechanism to (m~5 J2f=o ® |0) ® ••• ® where the 
state (m~2 |j)) is obtained from |0) by the application of Hadamard transforms, one 
for each bit. 

2. The application of the Fourier transform T. By the central result of Shor P| T 
can be implemented using 0[(logm) 2 ] gates, and we apply one Fourier transform per copy. 
Therefore, the fact that m has to be a large number, larger than the number of voters n, 
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should not pose a big problem. In fact, with k = 25 binary digits we can accommodate 
elections in a mid size country. However, even smaller scale Fourier transforms suffice to 
implement an elections protocol using the following trick: Let n be the number of voters and 
suppose first that we know n in advance. Suppose, moreover, that n = m 1 m 2 ...m s , where 
mi, m 2 , m s are coprime. Now, perform the election in parallel on the s states 

mi-l 

Where each term in Eq (11) has n copies. Assume that after the measurement on the k 
post-election states we get the results ci, c 2 , c^. The number of YES votes x is satisfying 

x = Ci(modmi), x = c 2 (modm2), x = c s (modm s ), (12) 

and this set of congruences has a unique solution mod n J(| . 

If we do not know n in advance, or if there is no nice decomposition of n to a product 
of coprimes, we can do as indicated previously: Choose a large enough n to be on the safe 
side, and make sure it has a comfortable decomposition. After election day is over push the 
NO button as many time as needed to bring the number of votes to n, and subsequently 
subtract the fictional votes before the result is announced. 

3. Application of II: Is just an implementation of an algorithm that performs j — > j + 1 
modm, which takes O(logm) steps per copy. 

Altogether, the complexity of the protocol is 0[n(log 2 m) 2 ] where n is the number of 
voters (or in another scheme, the number of ballot boxes) and m is the least power of two 
greater than the number of voters. 
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